0

With IPv6 there's new train of thought around this technology than IPv4. Since this protocol does away with broadcasts, is creating different VLANs necessary? Some people will argue that you can apply different ACLs on different VLANs, however SDN is also changing the way we manage our equipment.

I was wondering if there is a way to use SDN technology to tag a port like on Meraki devices to use in conjunction with security - i.e. Ports tagged with "general-client" cannot access servers with tag "High-Security"

This way, we can keep the network simple with one big LAN and also keep security.

-- EDIT -- Let me re-phrase my question since I think the question is confusing. Since IPv6 doesn't not have broadcast do we need separate L2 broadcast domains by creating VLANs? Even before new SDN technologies, we have technologies like isolated ports (like in ASA5505), VACLS and private VLAN, to stop hosts from talking to each other in the same LAN.

With SDN on the rise with tagged ports like with Meraki vendor, is the only thing that keeps us having one large internal corporate LAN, security boundaries - which SDN may solve in an IPv6 network? Having two different network segment between ISP and Internal Network is already understood.

Improve this question
3
  • 1
    As @Zac67 points out, you substantially changed the question, after you have answers, and that is bad form. You have really made the question too broad to answer. It was pretty close to being off-topic as primarily opinion-based, but now it is really too broad and primarily opinion-based. You could add many more details, e.g. a diagram and device models and configurations, and narrow the question to be more specific.
    – Ron Maupin ♦
    Commented Jan 9, 2018 at 21:34
  • @RonMaupin - Sorry I didn't mean to make "bad form." I had to edit because that's what closely resembles my original intent. if you wish, you can close topic...
    – JuniorPenguin
    Commented Jan 9, 2018 at 21:49
  • 1
    Just because the L3 protocol (V6) doesn't explicitly support broadcast doesn't mean that multicasts won't be treated as broadcasts by the underlying L2 transport. Similarly, there is absolutely such a thing as a multicast storm. Both conditions are alleviated by the (eminently L2) construct of the VLAN.
    – rnxrx
    Commented Jan 11, 2018 at 1:02

2 Answers 2

Reset to default
2

Creating a new VLAN for IPv6 isn't necessary. IPv4 and IPv6 can coexist perfectly in a single L2 segment. On Ethernet, each uses its own Ethertype and mixing them up somehow is literally impossible.

Introducing IPv6 may be a good occasion to review your network layout though. Security implented by ACLs will need a redesign anyway, so maybe a new VLAN may be a good idea after all.

PS: With your -EDIT- the question changes substantially. It isn't really about IPv6 and VLANs but "Do we need VLANs at all when we have SDN?"

It depends. Possibly, you don't software define your whole network at once and still need to run parts on VLANs. Additionally, implementing zoning by port groups alone may be complicated when you can't simply put a port into one zone or another. What it all adds up to depends on your SDN model and architecture, so I'd say there's no simple answer.

Improve this answer
1

Don't forget that devices on a layer-2 domain, e.g. VLAN, communicate directly without going through a layer-3 device, e.g. router or firewall. A host that is supposed to be restricted from communicating with another host on the same VLAN could simply set a different network address on its interface (very easy since IPv6 allow any number of addresses on the same interface) to bypass a network-based security by having an address on the correct network, also.

A current best practice is also to keep a VLAN restricted to a single access switch, and not connect access switches to each other. This will prevent many spanning tree problems. Going further, it is also recommended that you run layer-3 to your access switches, to completely prevent spanning tree problems.

In light of that, one very large VLAN across your entire network is really a bad idea.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.